848197 - Arrow functions should not be constructors

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

In the current ES6 draft, the runtime semantics of FunctionExpressions always call FunctionCreate followed by MakeConstructor to create a Function object that supports [[Construct]].

The runtime semantics of ArrowFunction only call FunctionCreate; they are supposed to create functions that do not support [[Construct]] and have no .prototype property.

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: v1

js> new (a=>a)
typein:1:0 TypeError: a=>a is not a constructor

Comment 2

[Jeff Walden [:Waldo]]

Comment on attachment 728105 [details] [diff] [review]
v1

Review of attachment 728105 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/arrow-functions/prototype-2.js
@@ +1,4 @@
> +// Arrow functions do not have a .prototype property.
> +
> +assertEq("prototype" in (a => a), false);
> +assertEq("prototype" in (() => {}), false);

Add hasOwnProperty and Object.getOwnPropertyDescriptor versions of these as well, for thoroughness.

::: js/src/jsfun.cpp
@@ +1078,5 @@
> +    if (constructing && fun->isArrow()) {
> +        /*
> +         * Per spec, arrow functions do not even have a [[Construct]] method.
> +         * So before anything else, if we are an arrow function, make sure we
> +         * don't even get here. You never saw me. Burn this comment.

Hmm.  Not sure about this.  Seems to me that bound functions should have a [[Construct]] if the target had a [[Construct]], just as direct proxies have a [[Construct]] if the target had a [[Construct]].  Aside from the syntax, it doesn't seem helpful to me, or clear to users, to have two subtly different conceptions of a bound function like this.

This probably needs spec-issue-raising, tho.  This'll work for now.

Comment 3

[Jason Orendorff [:jorendorff]]

I agree.

Our discussion revealed a bug in this patch. :(

    js> var p = new Proxy({}, {construct: x => { throw "FAIL!"; }});
    js> new p
    typein:4:0 TypeError: p is not a constructor

So far so good; {} doesn't have [[Construct]], therefore the Proxy p doesn't have it either. This means the handler.construct hook never gets called.

    js> p = new Proxy(a => a + 1, {construct: x => { throw "FAIL!"; }});

Since per spec, a => a + 1 doesn't have [[Construct]] either, this should behave exactly the same way. Alas:

    js> new p
    uncaught exception: FAIL!

I'll fix in follow-up bug 853987.

Comment 4

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f8cfd4a08a86

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f8cfd4a08a86